Merge branch 'master' into 33466-jobs-navigation-menu33466-jobs-navigation-menu

* master:
  Clarify API V5 being a compatability layer on top of GraphQL
  Update per discussion
  Use RequestStore on MR show.json query count spec
  Merge branch '25934-project-snippet-vis' into 'security-9-2'
  Merge branch 'dz-api-x-frame' into 'security-9-2'
  Merge branch 'dz-restrict-autocomplete' into 'security-9-1'
  Merge branch 'cherry-pick-dc2ac993' into 'security-9-2'
  Update rename_system_namespace_spec to new validations.
  Make the uploader use the updated folder
  Bring in security changes from the 9.2.5 release
  Bring in security changes from the 9.2.5 release
  GitLab GEO also does not support mysql replication

1 files changed, 2 insertions, 2 deletions

diff --git a/app/assets/javascripts/notes.js b/app/assets/javascripts/notes.js
index 929965de5c1..b0143b12cfe 100644
--- a/app/assets/javascripts/notes.js
+++ b/app/assets/javascripts/notes.js
@@ -1478,7 +1478,7 @@ const normalizeNewlines = function(str) {
       const cachedNoteBodyText = $noteBodyText.html();
 
       // Show updated comment content temporarily
-      $noteBodyText.html(formContent);
+      $noteBodyText.html(_.escape(formContent));
       $editingNote.removeClass('is-editing fade-in-full').addClass('being-posted fade-in-half');
       $editingNote.find('.note-headline-meta a').html('<i class="fa fa-spinner fa-spin" aria-label="Comment is being updated" aria-hidden="true"></i>');
 
@@ -1491,7 +1491,7 @@ const normalizeNewlines = function(str) {
         })
         .fail(() => {
           // Submission failed, revert back to original note
-          $noteBodyText.html(cachedNoteBodyText);
+          $noteBodyText.html(_.escape(cachedNoteBodyText));
           $editingNote.removeClass('being-posted fade-in');
           $editingNote.find('.fa.fa-spinner').remove();